T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:16- Finding
Shell Command Injection Through Unsanitized Agent Identity
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 16–29
Vulnerability Type: Shell command injection
Risk Level: HighVulnerable Code Snippet:
markdown ### Step 1: Generate Agent Information Generate the following information based on the user's input: | Item | Description | |--------|------| | **Agent Name** | Unique identifier, lowercase English, hyphen-separated | | **Identity Name** | Friendly name visible to users | | **SOUL.md** | Defines the agent's personality, communication style, and boundaries; affects interaction style | ### Step 2: Create Agent Using Commands ```bash openclaw agents add <agent-name> --workspace ~/.openclaw/workspace-<agent-name> openclaw agents set-identity --agent <agent-name> --name "<identity-name>"text ### Technical Analysis The skill instructs an agent to derive `identity-name` from user input and interpolate it into a shell command. Although the value is enclosed in double quotes, shell command substitutions such as `$(command)` and backtick substitutions remain active inside double-quoted strings. The document imposes a restricted naming format on `agent-name`, but it does not define equivalent validation or shell escaping for `identity-name`. If the generated command is executed through a shell, a malicious identity such as `$(attacker-command)` can cause an additional command to run before the resulting text is passed to `openclaw`. This vulnerability depends on the implementing agent directly substituting user-controlled content into the documented command and executing it through a shell. The package contains no executable scripts, but its operational instructions establish the unsafe execution pattern. ### Attack Path 1. An attacker requests creation of an agent and supplies an identity name containing shell syntax, such as `$(id > /tmp/openclaw-proof)`. 2. The skill treats the supplied value as the gen ...[truncated 1206 chars]- Remediation
View remediation
Remediation Suggestions
- Do not construct shell command strings from user-controlled values. Invoke
openclawthrough an API that accepts an argument array and does not launch a shell. - Apply explicit allowlist validation to both fields before execution:
- Restrict
agent-nameto a pattern such as^[a-z0-9]+(?:-[a-z0-9]+)*$. - Define and enforce a conservative character set and maximum length for
identity-name.
- Restrict
- Reject shell metacharacters and control characters, including command-substitution syntax, backticks, newlines, null bytes, and unexpected option-like values.
- Use an end-of-options delimiter where supported and keep every user-controlled value in a distinct process argument.
- If shell execution is unavoidable, use a proven shell-escaping routine appropriate to the exact shell rather than relying on double quotes.
- Update the skill instructions to require validation before any command is run and to request user confirmation showing the normalized agent and identity values.
- Execute the workflow with least privilege and restrict its filesystem, credential, and network access to reduce the impact of any command-injection failure.
- Add negative tests covering values such as
$(id), backtick substitutions, quotes, semicolons, newlines, leading hyphens, and path traversal sequences.
- Do not construct shell command strings from user-controlled values. Invoke